1921c8e44ac16a8c947f082088d08871eaf63cf1ddfa6aa866b8750b856b985b

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 05:32

Target

1921c8e44ac16a8c947f082088d08871eaf63cf1ddfa6aa866b8750b856b985b.dll
Size

50KB
MD5

c9cfcd6e5eec626b80d16421f46e73f1
SHA1

8cf0bfe6e9d64987fdd04863882968e2f291d1ef
SHA256

1921c8e44ac16a8c947f082088d08871eaf63cf1ddfa6aa866b8750b856b985b
SHA512

5b6925313843132db3826d1885e46de5b9c8a9999886a3a9bdf5d4e1e192b1f7c4d04ab098b1048bac42f6efb52294abac0a072b2e84ca3a8b94be3867fbc724
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5hJYH:W5ReWjTrW9rNPgYo3JYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2388	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2388	2784	rundll32.exe	28
PID 2784 wrote to memory of 2388	2784	rundll32.exe	28
PID 2784 wrote to memory of 2388	2784	rundll32.exe	28
PID 2784 wrote to memory of 2388	2784	rundll32.exe	28
PID 2784 wrote to memory of 2388	2784	rundll32.exe	28
PID 2784 wrote to memory of 2388	2784	rundll32.exe	28
PID 2784 wrote to memory of 2388	2784	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1921c8e44ac16a8c947f082088d08871eaf63cf1ddfa6aa866b8750b856b985b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1921c8e44ac16a8c947f082088d08871eaf63cf1ddfa6aa866b8750b856b985b.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2388